washort/amo-validator — comment on commit 2694c0b904373d2109efc85e649c406195ddcc5f
File: validator/testcases/regex.py line 45
By mattbasta:

I don't like this because it can easily be easily circumvented/tricked/false-negatived with something like `var temp = Components, Cc = temp.classes;`. This is why we have the JavaScript test engine; it will do the heavy lifting for us.

I suppose it's fine for now since there's not too much riding on the effectiveness of this, but ideally a simple modification to the `dangerous` property for predefined entities would make this a lot more thorough (and more easily testable).